When a request is created, the customer (or requester) is added as a watcher to that request. This is not visible in the Customer Portal but visible in the Agent view as well as JIRA issue view.
The fact that customers cannot access JIRA suggests that they should not be added as a watcher, except there's a special, technical reason for that. Indeed, if an agent manually tries to add a customer as a watcher, this error is thrown which sounds logical:
A clearer picture of how this works is highly appreciated.